1. In a sending computer system that is network connectable to one or more 
receiving computer systems, the sending computer system being configured to send 
electronic messages to the receiving computer systems, a method for indicating to a 
receiving computer system that the sending computer system is receiving connection 
responses from the receiving computer system, the method comprising: 

an act of sending connection initiation data to a receiving computer system, 
the connection initiation data including a purported sending address; 

an act of receiving altered connection establishment data that includes 
address validation data; 

an act generating appropriate connection response based on the address 
validation data; and 

sending the appropriate connection response data to the receiving computer 

system. 



2. The method as recited in claim 1, wherein the act of sending connection 
initiation data to a receiving computer system comprises an act of sending Transmission 



Control Protocol connection initiation data. 
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^^>oot 3. The method as recited in claim 1, wherein the act of sending connection 

O * £ I w 3 initiation data to a receiving computer system comprises an act of sending an SMTP HELO 
> 00 command or SMTP EHLO command. 



4. The method as recited in claim 1, wherein the act of receiving altered 
connection establishment data that includes address validation data comprises an act of 
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receiving altered connection establishment data wherein the altered connection 
establishment data is selected from among a request to resend connection initiation data and 
connection establishment data that has been separated into a plurality of network packets. 



5. The method as recited in claim 1, wherein the act of receiving altered 
connection establishment data that includes address validation data comprises an act of 
receiving an act of receiving a HELO response command or EHLO response command that 
includes a random sequence of characters.. 

6. The method as recited in claim 1, wherein the act of generating an 
appropriate connection response based on the address validation data comprises an act of 
generating an appropriate connection response wherein the appropriate connection response 
is selected from among resending the connection initiation data and sending a network 
packet with an appropriate acknowledgment sequence number. 

7. The method as recited in claim 1, wherein the act of generating an 
& appropriate connection response based on the address validation data comprises an act of 
§ 2j 1 1 & Z including a random sequence of characters in an enhanced NOOP command, the random 
^ d > o 1 1 sequence of characters being received from the receiving computer system in response to the 
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S g h sS < 3 connection initiation data. 

8. The method as recited in claim 1, wherein the act of sending the appropriate 
connection response data to the receiving computer system comprises an act of sending an 
enhanced NOOP command that includes a random sequence of characters, the random 
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sequence of characters being received from the receiving computer system in response to the 
connection initiation data. 
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10. In a receiving computer system that is network correctable to one or more 
sending computer systems, the receiving computer system being configured to receive 
electronic messages from the sending computer systems, a method for the receiving 
computer system detecting whether a sending computer system is receiving connection 
establishment responses, the method comprising: 

an act of receiving connection initiation data from a sending computer 
system, the connection initiation data including a purported sending address; 

an act of altering standard connection establishment data to include address 
validation data; 

an act of sending the altered connection establishment data to the purported 
sending address; and 

an act of determining if a computer system that corresponds to the purported 
sending address appropriately responded to the address validation data. 



11. The method as recited claim 10, wherein the act of receiving connection 
initiation data from a sending computer system comprises an act of receiving Transmission 
g Control Protocol connection initiation data. 
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fiBfcwS 5 ! 12. The method as recited claim 10, wherein the act of receiving connection 

initiation data from a sending computer system comprises an act of receiving an SMTP 
HELO command or receiving an SMTP EHLO command. 
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13. The method as recited in claim 10, wherein the act of altering standard 
connection establishment data to include address validation data comprises an act of altering 
a standard response to Transmission Control Protocol connection initiation data to request 
retransmission of the Transmission Control Protocol connection initiation data. 



14. The method as recited in claim 10, wherein the act of altering standard 
connection establishment data to include address validation data comprises an act of 
separating Transmission Control Protocol connection establishment data into a plurality of 
network packets. 



15. The method as recited in claim 10, wherein the act of altering standard 
connection establishment data to include address validation data comprises an act of 
including a random sequence of characters in an SMTP HELO response command or SMTP 
EHLO response command. 



16. The method as recited in claim 10 wherein, the act of sending the altered 
gj connection establishment data to the purported sending address comprises an act of sending 

W S % § | " altered Transmission Control Protocol connection establishment data to a purported Internet 
z 3 52 o s £ Protocol address. 
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^ M 17. The method as recited in claim 10 wherein, the act of sending the altered 

connection establishment data to the purported sending address comprises an act of sending 
an SMTP HELO response command or sending an SMTP EHLO response command that 
includes a random sequence of characters. 
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18. The method as recited in claim 10, wherein the act of determining if a 
computer system that corresponds to the purported sending address appropriately responded 
to the address validation data comprises an act of determining if the purported sending 
address responded appropriately to altered Transmission Control Protocol connection 
establishment data. 

19. The method as recited in claim 10, wherein the act of determining if a 
computer system that corresponds to the purported sending address appropriately responded 
to the address validation data comprises an act of determining if the purported sending 
address responded appropriately to altered Transmission Control Protocol connection 
establishment data. 

20. The method as recited in claim 10, wherein the act of determining if a 
computer system that corresponds to the purported sending address appropriately responded 
to the address validation data comprises an act of determining if the purported sending 
address responded with an enhanced NOOP command including a random string of 
characters that was included in the address validation data. 

21 . The method as recited in claim 10, further comprising: 

an act of issuing a DNS query for a DNS record set corresponding to the 
purported sending address, when the purported sending address does not 
appropriately respond to the address validation data; and 



- Page 66 - 



Docket No. 13768.418.1 



an act of receiving one or more TXT records that include XML instructions 
indicating whether or not the purported sending address supports the use of address 
validation data. 
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22. In a receiving domain that is network connectable to one or more sending 
domains, the receiving domain including one or more receiving messaging servers 
configured to receive electronic messages from sending domains, a method for determining 
if a sending messaging server is authorized to send electronic messages for a sending 
domain, the method comprising: 

an act of receiving an electronic message purportedly sent from the sending 
domain; 

an act of examining a plurality of parameter values of the electronic message 
to attempt to identify an actual sending side network address corresponding to a 
sending computer system; 

an act of querying a name server for a list of network addresses authorized to 
send electronic messages for the sending domain; 

an act of determining if the actual sending side network address is authorized 
to send electronic messages for the sending domain; and 

an act of providing results of the determination to an message classification 
module such that the message classification module can make a more reliable 
g4 decision as to classifying the received electronic message. 

•Zi. 1 9 § t 23 ■ The method as recited in claim 22, wherein the act of receiving an 

6 I £ I | 3 electronic message purportedly sent from the sending side domain comprises an act 
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^ of receiving an electronic mail message. 
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24. The method as recited in claim 22, wherein an act of receiving an electronic 
message purportedly sent from the sending domain comprises an act of receiving an 
electronic message that does not include a Reverse-Path parameter value. 



25. The method as recited in claim 22, wherein an act of examining a plurality of 
parameter values of the electronic message to attempt to identify an actual sending side 
network address comprises an act of identifying an Internet Protocol address corresponding 
to the sending computer system. 



26. The method as recited in claim 22, wherein an act of examining a plurality of 
parameter values of the electronic message to attempt to identify an actual sending side 
network address comprises an act of examining a plurality of parameter values wherein at 
least one of the plurality of parameter values is selected from among a first Resent-Sender 
header value, a first mailbox value in the Resent-From header, a Sender header value, or a 
first mailbox value in the From header. 



27. The method as recited in claim 22, wherein the act of querying a name server 
w § < I ix for a list of network addresses authorized to send electronic messages for the sending 
5 i > o B £ domain comprises an act of querying a Domain Name Services server for a list of network 
§ 1 1 2 3 3 addresses authorized to send electronic messages for the sending domain. 

28. The method as recited in claim 27, wherein the act of querying a Domain 
Name Services server for a list of network addresses authorized to send electronic messages 
for the sending domain comprises the act of querying a Domain Name Services for a list of 

- Page 69 - Docket No. 13768.418.1 



Internet Protocol addresses authorized to send electronic mail message for the sending 



domain. 



29. The method as recited in claim 22, further comprising: 

an act of receiving a list of network addresses that are authorized to send 
electronic messages for the sending domain. 

30. The method as recited in claim 29, wherein an act of receiving a list of 
network addresses that are authorized to send electronic messages comprises an act of 
receiving one or more DNS TXT records. 

31. The method as recited in claim 30, wherein an act of receiving a list of 
network addresses that are authorized to send electronic messages comprises an act of 
receiving one or more DNS TXT records that encode the list of network addresses in XML 
instructions. 




32. The method as recited in claim 31, wherein an act of receiving one or more 




|i 3 plurality DNS TXT records such that the electronic message configuration information can 



be concatenated into an XML instance. 



33. The method as recited in claim 32, wherein the act of receiving electronic 
messaging configuration information that spans across a plurality DNS TXT records such 
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that the electronic message configuration information can be concatenated into an XML 
instance comprises an act of receiving a plurality of DNS TXT records that include ordering 
data indicating how the XML instructions contained in the DNS TXT records are to be 
ordered. 



34. The method as recited in claim 33, further comprising: 

an act of concatenating the XML instructions according to the ordering data 
to generate an XML instance. 



35. The method as recited in claim 22, wherein the act of determining if the 
actual sending side network address is authorized to send electronic messages for the 
sending domain comprises an act of determining that the actual sending side network 
address is contained in a received list of authorized network addresses. 



36. The method as recited in claim 22, wherein the act of determining if the 
actual sending side network address is authorized to send electronic messages for the 
& sending domain comprises an act of determining that the actual sending side network 

w Is < 1 1 Z address is not contained in a received list of authorized network addresses. 
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^ < results of the determination to an message classification module comprises an act of 

indicating to the message classification module that the actual sending side network address 
is authorized to send electronic messages for the sending domain. 
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38. The method as recited in claim 22, wherein the act of an act of providing 
results of the determination to an message classification module comprises an act of 
indicating to the message classification module that the actual sending side network address 
is not authorized to send electronic messages for the sending domain. 
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39. A computer program product for use in a sending computer system that is 
network connectable to one or more receiving computer systems, the sending computer 
system being configured to send electronic messages to the receiving computer systems, the 
computer program product for implementing a method for indicating to a receiving 
computer system that the sending computer system is receiving connection responses from 
the receiving computer system, the computer program product comprising one or more 
computer-readable media having stored thereon computer executable instructions that, when 
executed by a processor, cause the sending computer system to perform the following: 

send connection initiation data to a receiving computer system, the 
connection initiation data including a purported sending address; 

receive altered connection establishment data that includes address validation 

data; 

generate appropriate connection response based on the address validation 
data; and 

send the appropriate connection response data to the receiving computer 

system. 

40. The computer program product as recited in claim 39, wherein computer- 
executable instructions that, when executed by a processor, cause the sending computer 
system to receive altered connection establishment data that includes address validation data 
comprise computer-executable instructions that, when executed by a processor, cause the 
sending computer system to receive an SMTP HELO command or SMTP EHLO command 
that includes a random sequence of characters. 
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41. The computer program product as recited in claim 39, wherein computer- 
executable instructions that, when executed by a processor, cause the sending computer 
system to send the appropriate connection response data to the receiving computer system 
comprise computer-executable instructions that, when executed by a processor, cause the 
sending computer system to send an enhanced SMTP NOOP command including a random 
sequence of characters that was included in the received address validation data. 
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42. A computer program product for use in a receiving computer system that is 
network connectable to one or more sending computer systems, the receiving computer 
system being configured to receive electronic messages from the sending computer systems, 
the computer program product for implementing a method for the receiving computer 
system detecting whether a sending computer system is receiving connection establishment 
responses, the computer program product comprising one or more computer-readable media 
having stored thereon computer executable instructions that, when executed by a processor, 
cause the receiving computer system to perform the following: 

receive connection initiation data from a sending computer system, the 
connection initiation data including the purported sending address; 

alter standard connection establishment data to include address validation 

data; 

send the altered connection establishment data to the purported sending 
address; and 

determine if a computer system that corresponds to the purported sending 
address appropriately responded to the address validation data. 

43. The computer program product as recited in claim 42, wherein computer- 
executable instructions that, when executed by a processor, cause the receiving computer 
system to alter standard connection establishment data to include address validation data 
comprises computer-executable instructions that, when executed by a processor, cause the 
receiving computer system to include a random sequence of characters in an SMTP HELO 
response command or SMTP EHLO response command. 
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44. The computer program product as recited in claim 42, wherein computer- 
executable instructions that, when executed by a processor, cause the receiving computer 
system to send the altered connection establishment data to the purported sending address 
comprise computer-executable instructions that, when executed by a processor, cause the 
receiving computer system to send an SMTP HELO response command or send an SMTP 
EHLO response command that includes a random sequence of characters. 



45. The computer-program product as recited in claim 42, further comprinsing: 

one or more computer-readable media having stored thereon computer 
executable instructions that, when executed by a processor, cause the receiving 
computer system to perform the following: 

issue a DNS query for a DNS record set corresponding to the 
purported sending address, when the purported sending address does not 
appropriately respond to the address validation data; and 

receive one or more TXT records that include XML instructions 
indicating whether or not the purported sending address supports the use of 



dS address validation data. 
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46. A computer program product for use in a receiving domain that is network 
connectable to one or more sending domains, the receiving domain including one or more 
receiving messaging servers configured to receive electronic messages from sending 
domains, the computer program product for implementing a method for determining if a 
sending messaging server is authorized to send electronic messages for a sending domain, 
the computer program product comprising one or more computer-readable media having 
stored thereon computer executable instructions that, when executed by a processor, cause 
the receiving domain to perform the following: 

receive an electronic message purportedly sent from the sending domain; 
examine a plurality of parameter values of the electronic message to attempt 

to identify an actual sending side network address corresponding to the sending 

computer system; 

query a name server for a list of network addresses authorized to send 
electronic messages for the sending domain; 

determine if the actual sending side network address is authorized to send 
electronic messages for the sending domain; and 

provide results of the determination to an message classification module such 
that the message classification module can make a more reliable decision as to 
classifying the received electronic message. 

47. The computer program product as recited in claim 46, wherein computer 
executable instructions that, when executed by a processor, cause the receiving domain to 
examine a plurality of parameter values of the electronic message to attempt to identify an 
actual sending side network address comprise computer executable instructions that, when 
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executed by a processor, cause the receiving domain to examine a plurality of parameter 
values wherein at least one of the plurality of parameter values is selected from among a 
first Resent-Sender header value, a first mailbox value in the Resent-From header, a Sender 
header value, or a first mailbox value in the From header. 

48. The computer-program product as recited in claim 46, further comprising: 
one or more computer-readable media having stored thereon computer 

executable instructions that, when executed by a processor, cause the receiving 
domain to perform the following: 

receive a list of network addresses that are authorized to send 
electronic messages for the sending domain. 

49. The computer-program product as recited in claim 46, wherein computer 
executable instructions that, when executed by a processor, cause the receiving domain to 
receive a list of network addresses that are authorized to send electronic messages comprise 
computer executable instructions that, when executed by a processor, cause the receiving 
domain to receive one or more DNS TXT records that include XML instructions. 
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